tocsin

CVE-2026-44437

1 advisory.

npm/@angular/ssr CVE-2026-44437: medium

Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix

Action: Upgrade @angular/ssr to 19.2.25 or later.

npm i @angular/ssr@22.0.0-next.7
npm i @angular/ssr@21.2.9
npm i @angular/ssr@20.3.25
npm i @angular/ssr@19.2.25

Affected

introducedfixedlast affected
22.0.0-next.022.0.0-next.7-
21.0.0-next.021.2.9-
20.0.0-next.020.3.25-
19.0.0-next.019.2.25-

Fixed versions

22.0.0-next.721.2.920.3.2519.2.25

Sources

CVE-2026-44437 · published · modified · JSON